Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

a few more small fixes for chains containing broken certs.

Browse source
This commit is contained in:
Bernhard Amann 2014-05-21 11:01:33 -07:00
parent b16322aefb
commit ff00c0786a
4 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/ssl/files.bro
View file

@ -121,13 +121,13 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
event ssl_established(c: connection) &priority=6 event ssl_established(c: connection) &priority=6
{ {
# update subject and issuer information # update subject and issuer information
if ( c$ssl?$cert_chain && |c$ssl$cert_chain| > 0 ) if ( c$ssl?$cert_chain && |c$ssl$cert_chain| > 0 && c$ssl$cert_chain[0]?$x509 )
{ {
c$ssl$subject = c$ssl$cert_chain[0]$x509$certificate$subject; c$ssl$subject = c$ssl$cert_chain[0]$x509$certificate$subject;
c$ssl$issuer = c$ssl$cert_chain[0]$x509$certificate$issuer; c$ssl$issuer = c$ssl$cert_chain[0]$x509$certificate$issuer;
} }
if ( c$ssl?$client_cert_chain && |c$ssl$client_cert_chain| > 0 ) if ( c$ssl?$client_cert_chain && |c$ssl$client_cert_chain| > 0 && c$ssl$cert_chain[0]?$x509 )
{ {
c$ssl$client_subject = c$ssl$client_cert_chain[0]$x509$certificate$subject; c$ssl$client_subject = c$ssl$client_cert_chain[0]$x509$certificate$subject;
c$ssl$client_issuer = c$ssl$client_cert_chain[0]$x509$certificate$issuer; c$ssl$client_issuer = c$ssl$client_cert_chain[0]$x509$certificate$issuer;

2
scripts/policy/protocols/ssl/known-certs.bro
View file

@ -48,7 +48,7 @@ event bro_init() &priority=5
event ssl_established(c: connection) &priority=3 event ssl_established(c: connection) &priority=3
{ {
if ( ! c$ssl?$cert_chain || |c$ssl$cert_chain| < 1 ) if ( ! c$ssl?$cert_chain || |c$ssl$cert_chain| < 1 || ! c$ssl$cert_chain[0]?$x509 )
return; return;
local fuid = c$ssl$cert_chain_fuids[0]; local fuid = c$ssl$cert_chain_fuids[0];

2
scripts/policy/protocols/ssl/validate-certs.bro
View file

@ -28,7 +28,7 @@ export {
event ssl_established(c: connection) &priority=3 event ssl_established(c: connection) &priority=3
{ {
# If there aren't any certs we can't very well do certificate validation. # If there aren't any certs we can't very well do certificate validation.
if ( ! c$ssl?$cert_chain || |c$ssl$cert_chain| == 0 ) if ( ! c$ssl?$cert_chain || |c$ssl$cert_chain| == 0 || !c$ssl$cert_chain[0]?$x509 )
return; return;
local chain_id = join_string_vec(c$ssl$cert_chain_fuids, "."); local chain_id = join_string_vec(c$ssl$cert_chain_fuids, ".");

4
src/file_analysis/analyzer/x509/functions.bif
View file

@ -86,8 +86,10 @@ STACK_OF(X509)* x509_get_untrusted_stack(VectorVal* certs_vec)
{ {
Val *sv = certs_vec->Lookup(i); Val *sv = certs_vec->Lookup(i);
// Fixme: check type if ( !sv )
continue;
// Fixme: check type
X509* x = ((file_analysis::X509Val*) sv)->GetCertificate(); X509* x = ((file_analysis::X509Val*) sv)->GetCertificate();
if ( ! x ) if ( ! x )
{ {